raccoon | 0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23-07-2024 01:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe
Size

2.3MB
MD5

010d3ed12031239d3f314f66bb28d58d
SHA1

9daa168735a3f72e715f87d952a18f6c8f00238c
SHA256

0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87
SHA512

07234248dcb4d331e15bc102d83442723e5c887ded4cb8b9a66a288ea72560b7b85c169e08d192a035ff757dc8b0efdb555af97e7171bb378d17cd1c35a4e863
SSDEEP

49152:MJ8U/HLU3Yp7dPM8V/HLU3Yp7CgUxK3h7/SEyIas8JWsa6HdLm:MJ8U/HQ3r8V/HQ3BbxKxD9jXsj9Lm

Score

10^/10

raccoon dd188c0be5001b2c8fb76d74174694cd stealer

Malware Config

Extracted

Family

raccoon

Botnet

dd188c0be5001b2c8fb76d74174694cd

http://147.45.44.25:80/

http://85.28.47.116:80/

Attributes

user_agent
MrBidenNeverKnow

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 7 IoCs

resource	yara_rule
behavioral1/memory/1284-7-0x0000000000400000-0x00000000004D0000-memory.dmp	family_raccoon_v2
behavioral1/memory/1284-9-0x0000000000400000-0x00000000004D0000-memory.dmp	family_raccoon_v2
behavioral1/memory/1284-10-0x0000000000400000-0x00000000004D0000-memory.dmp	family_raccoon_v2
behavioral1/memory/1284-4-0x0000000000400000-0x00000000004D0000-memory.dmp	family_raccoon_v2
behavioral1/memory/1284-3-0x0000000000400000-0x00000000004D0000-memory.dmp	family_raccoon_v2
behavioral1/memory/2248-21-0x0000000000400000-0x00000000004D0000-memory.dmp	family_raccoon_v2
behavioral1/memory/1284-32-0x0000000000400000-0x00000000004D0000-memory.dmp	family_raccoon_v2

Suspicious use of SetThreadContext 14 IoCs

description	pid	Process	procid_target
PID 2224 set thread context of 1284	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	30
PID 2224 set thread context of 2248	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	32
PID 2224 set thread context of 2716	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	33
PID 2224 set thread context of 2144	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	34
PID 2224 set thread context of 2736	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	35
PID 2224 set thread context of 3012	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	36
PID 2224 set thread context of 2008	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	38
PID 2864 set thread context of 2860	2864	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	40
PID 2864 set thread context of 300	2864	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	41
PID 2864 set thread context of 1772	2864	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	42
PID 2864 set thread context of 1808	2864	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	44
PID 2864 set thread context of 1512	2864	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	45
PID 2020 set thread context of 2428	2020	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	47
PID 2020 set thread context of 2320	2020	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	48

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 1284	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	30
PID 2224 wrote to memory of 1284	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	30
PID 2224 wrote to memory of 1284	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	30
PID 2224 wrote to memory of 1284	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	30
PID 2224 wrote to memory of 1284	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	30
PID 2224 wrote to memory of 1284	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	30
PID 2224 wrote to memory of 1284	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	30
PID 2224 wrote to memory of 1284	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	30
PID 2224 wrote to memory of 1284	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	30
PID 2224 wrote to memory of 1284	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	30
PID 2224 wrote to memory of 2248	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	32
PID 2224 wrote to memory of 2248	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	32
PID 2224 wrote to memory of 2248	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	32
PID 2224 wrote to memory of 2248	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	32
PID 2224 wrote to memory of 2248	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	32
PID 2224 wrote to memory of 2248	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	32
PID 2224 wrote to memory of 2248	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	32
PID 2224 wrote to memory of 2248	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	32
PID 2224 wrote to memory of 2248	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	32
PID 2224 wrote to memory of 2248	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	32
PID 2224 wrote to memory of 2716	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	33
PID 2224 wrote to memory of 2716	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	33
PID 2224 wrote to memory of 2716	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	33
PID 2224 wrote to memory of 2716	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	33
PID 2224 wrote to memory of 2716	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	33
PID 2224 wrote to memory of 2716	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	33
PID 2224 wrote to memory of 2716	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	33
PID 2224 wrote to memory of 2716	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	33
PID 2224 wrote to memory of 2716	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	33
PID 2224 wrote to memory of 2716	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	33
PID 2224 wrote to memory of 2144	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	34
PID 2224 wrote to memory of 2144	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	34
PID 2224 wrote to memory of 2144	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	34
PID 2224 wrote to memory of 2144	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	34
PID 2224 wrote to memory of 2144	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	34
PID 2224 wrote to memory of 2144	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	34
PID 2224 wrote to memory of 2144	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	34
PID 2224 wrote to memory of 2144	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	34
PID 2224 wrote to memory of 2144	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	34
PID 2224 wrote to memory of 2144	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	34
PID 2224 wrote to memory of 2736	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	35
PID 2224 wrote to memory of 2736	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	35
PID 2224 wrote to memory of 2736	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	35
PID 2224 wrote to memory of 2736	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	35
PID 2224 wrote to memory of 2736	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	35
PID 2224 wrote to memory of 2736	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	35
PID 2224 wrote to memory of 2736	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	35
PID 2224 wrote to memory of 2736	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	35
PID 2224 wrote to memory of 2736	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	35
PID 2224 wrote to memory of 2736	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	35
PID 2224 wrote to memory of 3012	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	36
PID 2224 wrote to memory of 3012	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	36
PID 2224 wrote to memory of 3012	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	36
PID 2224 wrote to memory of 3012	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	36
PID 2224 wrote to memory of 3012	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	36
PID 2224 wrote to memory of 3012	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	36
PID 2224 wrote to memory of 3012	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	36
PID 2224 wrote to memory of 3012	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	36
PID 2224 wrote to memory of 3012	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	36
PID 2224 wrote to memory of 3012	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	36
PID 2224 wrote to memory of 2008	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	38
PID 2224 wrote to memory of 2008	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	38
PID 2224 wrote to memory of 2008	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	38
PID 2224 wrote to memory of 2008	2224	0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe	38

C:\Users\Admin\AppData\Local\Temp\0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe
"C:\Users\Admin\AppData\Local\Temp\0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Users\Admin\AppData\Local\Temp\0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe
  "C:\Users\Admin\AppData\Local\Temp\0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe"
  2⤵
  PID:1284
- C:\Users\Admin\AppData\Local\Temp\0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe
  "C:\Users\Admin\AppData\Local\Temp\0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe"
  2⤵
  PID:2248
- C:\Users\Admin\AppData\Local\Temp\0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe
  "C:\Users\Admin\AppData\Local\Temp\0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe"
  2⤵
  PID:2716
- C:\Users\Admin\AppData\Local\Temp\0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe
  "C:\Users\Admin\AppData\Local\Temp\0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe"
  2⤵
  PID:2144
- C:\Users\Admin\AppData\Local\Temp\0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe
  "C:\Users\Admin\AppData\Local\Temp\0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe"
  2⤵
  PID:2736
- C:\Users\Admin\AppData\Local\Temp\0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe
  "C:\Users\Admin\AppData\Local\Temp\0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe"
  2⤵
  PID:3012
- C:\Users\Admin\AppData\Local\Temp\0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe
  "C:\Users\Admin\AppData\Local\Temp\0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe"
  2⤵
  PID:2008
- C:\Users\Admin\AppData\Local\Temp\0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe
  "C:\Users\Admin\AppData\Local\Temp\0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:2864
- - C:\Users\Admin\AppData\Local\Temp\0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe
    "C:\Users\Admin\AppData\Local\Temp\0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe"
    3⤵
    PID:2860
- - C:\Users\Admin\AppData\Local\Temp\0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe
    "C:\Users\Admin\AppData\Local\Temp\0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe"
    3⤵
    PID:300
- - C:\Users\Admin\AppData\Local\Temp\0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe
    "C:\Users\Admin\AppData\Local\Temp\0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe"
    3⤵
    PID:1772
- - C:\Users\Admin\AppData\Local\Temp\0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe
    "C:\Users\Admin\AppData\Local\Temp\0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe"
    3⤵
    PID:1808
- - C:\Users\Admin\AppData\Local\Temp\0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe
    "C:\Users\Admin\AppData\Local\Temp\0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe"
    3⤵
    PID:1512
- - C:\Users\Admin\AppData\Local\Temp\0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe
    "C:\Users\Admin\AppData\Local\Temp\0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe"
    3⤵
    - Suspicious use of SetThreadContext
    PID:2020
  - - C:\Users\Admin\AppData\Local\Temp\0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe
      "C:\Users\Admin\AppData\Local\Temp\0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe"
      4⤵
      PID:2428
  - - C:\Users\Admin\AppData\Local\Temp\0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe
      "C:\Users\Admin\AppData\Local\Temp\0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe"
      4⤵
      PID:2320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1284-7-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/1284-9-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/1284-10-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/1284-4-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/1284-2-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/1284-1-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/1284-5-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1284-3-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/1284-0-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/1284-32-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/2248-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2248-21-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download